Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 10:48
Behavioral task
behavioral1
Sample
202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe
Resource
win7-20240704-en
General
-
Target
202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe
-
Size
5.9MB
-
MD5
3d969de7f5c82111ed2bc8f3401c124a
-
SHA1
2c7c2146ea5bb8defc71605a7c5ad3300a6ffc21
-
SHA256
c4bdfc955b420001bc385bbd37fabbc2f7c80ac998f8805d977ba67a62633445
-
SHA512
dc2588b0e748071933ff751e69cd5573c1fc57b45ab43595e1d31957eaca7ffdfa03456898fc6884faff1baece07862b43788f7dde10e244cca4c25f002d1a32
-
SSDEEP
98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUn:T+q56utgpPF8u/7n
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x000d000000016d07-6.dat cobalt_reflective_dll behavioral1/files/0x0009000000016d89-8.dat cobalt_reflective_dll behavioral1/files/0x00060000000174d0-32.dat cobalt_reflective_dll behavioral1/files/0x000700000001722f-24.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fac-68.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fba-113.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fc1-116.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fcd-136.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fcb-131.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fb9-120.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fc2-124.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fb6-100.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fb8-106.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fb4-79.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fb5-88.dat cobalt_reflective_dll behavioral1/files/0x0005000000018fb0-75.dat cobalt_reflective_dll behavioral1/files/0x0006000000018d48-62.dat cobalt_reflective_dll behavioral1/files/0x0009000000016d66-56.dat cobalt_reflective_dll behavioral1/files/0x0003000000017801-42.dat cobalt_reflective_dll behavioral1/files/0x00070000000185e6-48.dat cobalt_reflective_dll behavioral1/files/0x000700000001722b-11.dat cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
XMRig Miner payload 56 IoCs
resource yara_rule behavioral1/memory/2356-0-0x000000013F560000-0x000000013F8B4000-memory.dmp xmrig behavioral1/files/0x000d000000016d07-6.dat xmrig behavioral1/files/0x0009000000016d89-8.dat xmrig behavioral1/memory/1964-16-0x000000013F9C0000-0x000000013FD14000-memory.dmp xmrig behavioral1/memory/3036-15-0x000000013F800000-0x000000013FB54000-memory.dmp xmrig behavioral1/memory/3064-23-0x000000013F4D0000-0x000000013F824000-memory.dmp xmrig behavioral1/files/0x00060000000174d0-32.dat xmrig behavioral1/files/0x000700000001722f-24.dat xmrig behavioral1/memory/2356-40-0x000000013FDA0000-0x00000001400F4000-memory.dmp xmrig behavioral1/memory/2604-65-0x000000013FD10000-0x0000000140064000-memory.dmp xmrig behavioral1/files/0x0005000000018fac-68.dat xmrig behavioral1/files/0x0005000000018fba-113.dat xmrig behavioral1/files/0x0005000000018fc1-116.dat xmrig behavioral1/files/0x0005000000018fcd-136.dat xmrig behavioral1/files/0x0005000000018fcb-131.dat xmrig behavioral1/files/0x0005000000018fb9-120.dat xmrig behavioral1/files/0x0005000000018fc2-124.dat xmrig behavioral1/memory/1992-102-0x000000013F750000-0x000000013FAA4000-memory.dmp xmrig behavioral1/files/0x0005000000018fb6-100.dat xmrig behavioral1/memory/1724-96-0x000000013F180000-0x000000013F4D4000-memory.dmp xmrig behavioral1/memory/1728-95-0x000000013F950000-0x000000013FCA4000-memory.dmp xmrig behavioral1/files/0x0005000000018fb8-106.dat xmrig behavioral1/memory/2356-139-0x000000013F8D0000-0x000000013FC24000-memory.dmp xmrig behavioral1/memory/3016-81-0x000000013F8D0000-0x000000013FC24000-memory.dmp xmrig behavioral1/files/0x0005000000018fb4-79.dat xmrig behavioral1/memory/2904-92-0x000000013F9C0000-0x000000013FD14000-memory.dmp xmrig behavioral1/memory/2524-72-0x000000013F1D0000-0x000000013F524000-memory.dmp xmrig behavioral1/files/0x0005000000018fb5-88.dat xmrig behavioral1/memory/2356-141-0x000000013F950000-0x000000013FCA4000-memory.dmp xmrig behavioral1/memory/2696-78-0x000000013FDA0000-0x00000001400F4000-memory.dmp xmrig behavioral1/files/0x0005000000018fb0-75.dat xmrig behavioral1/memory/2880-59-0x000000013FCF0000-0x0000000140044000-memory.dmp xmrig behavioral1/memory/2356-58-0x000000013F560000-0x000000013F8B4000-memory.dmp xmrig behavioral1/files/0x0006000000018d48-62.dat xmrig behavioral1/files/0x0009000000016d66-56.dat xmrig behavioral1/memory/2608-52-0x000000013F420000-0x000000013F774000-memory.dmp xmrig behavioral1/memory/2904-43-0x000000013F9C0000-0x000000013FD14000-memory.dmp xmrig behavioral1/files/0x0003000000017801-42.dat xmrig behavioral1/memory/2696-39-0x000000013FDA0000-0x00000001400F4000-memory.dmp xmrig behavioral1/memory/2704-36-0x000000013F960000-0x000000013FCB4000-memory.dmp xmrig behavioral1/files/0x00070000000185e6-48.dat xmrig behavioral1/files/0x000700000001722b-11.dat xmrig behavioral1/memory/3036-143-0x000000013F800000-0x000000013FB54000-memory.dmp xmrig behavioral1/memory/1964-144-0x000000013F9C0000-0x000000013FD14000-memory.dmp xmrig behavioral1/memory/3064-145-0x000000013F4D0000-0x000000013F824000-memory.dmp xmrig behavioral1/memory/2704-146-0x000000013F960000-0x000000013FCB4000-memory.dmp xmrig behavioral1/memory/2696-147-0x000000013FDA0000-0x00000001400F4000-memory.dmp xmrig behavioral1/memory/2904-148-0x000000013F9C0000-0x000000013FD14000-memory.dmp xmrig behavioral1/memory/2608-149-0x000000013F420000-0x000000013F774000-memory.dmp xmrig behavioral1/memory/2880-150-0x000000013FCF0000-0x0000000140044000-memory.dmp xmrig behavioral1/memory/2604-151-0x000000013FD10000-0x0000000140064000-memory.dmp xmrig behavioral1/memory/2524-152-0x000000013F1D0000-0x000000013F524000-memory.dmp xmrig behavioral1/memory/3016-153-0x000000013F8D0000-0x000000013FC24000-memory.dmp xmrig behavioral1/memory/1728-154-0x000000013F950000-0x000000013FCA4000-memory.dmp xmrig behavioral1/memory/1724-155-0x000000013F180000-0x000000013F4D4000-memory.dmp xmrig behavioral1/memory/1992-156-0x000000013F750000-0x000000013FAA4000-memory.dmp xmrig -
Executes dropped EXE 21 IoCs
pid Process 3036 bgmCAPZ.exe 1964 TAKNIzQ.exe 3064 RJXEvcQ.exe 2704 pZsxSwi.exe 2696 VYhCUAS.exe 2904 NoEZEEo.exe 2608 lgCeoKf.exe 2880 XDcmixu.exe 2604 mWLTgSf.exe 2524 uvPQvyx.exe 3016 QZAWNXh.exe 1728 hGiQWFO.exe 1724 CfjMRvA.exe 1992 fsnorYV.exe 2388 sMjbBqD.exe 1084 wLOiYFZ.exe 2800 UDerJCj.exe 2168 NwHzfow.exe 1424 TSOeCPn.exe 2216 nXXLFXa.exe 960 rNKmruE.exe -
Loads dropped DLL 21 IoCs
pid Process 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe -
resource yara_rule behavioral1/memory/2356-0-0x000000013F560000-0x000000013F8B4000-memory.dmp upx behavioral1/files/0x000d000000016d07-6.dat upx behavioral1/files/0x0009000000016d89-8.dat upx behavioral1/memory/1964-16-0x000000013F9C0000-0x000000013FD14000-memory.dmp upx behavioral1/memory/3036-15-0x000000013F800000-0x000000013FB54000-memory.dmp upx behavioral1/memory/3064-23-0x000000013F4D0000-0x000000013F824000-memory.dmp upx behavioral1/files/0x00060000000174d0-32.dat upx behavioral1/files/0x000700000001722f-24.dat upx behavioral1/memory/2604-65-0x000000013FD10000-0x0000000140064000-memory.dmp upx behavioral1/files/0x0005000000018fac-68.dat upx behavioral1/files/0x0005000000018fba-113.dat upx behavioral1/files/0x0005000000018fc1-116.dat upx behavioral1/files/0x0005000000018fcd-136.dat upx behavioral1/files/0x0005000000018fcb-131.dat upx behavioral1/files/0x0005000000018fb9-120.dat upx behavioral1/files/0x0005000000018fc2-124.dat upx behavioral1/memory/1992-102-0x000000013F750000-0x000000013FAA4000-memory.dmp upx behavioral1/files/0x0005000000018fb6-100.dat upx behavioral1/memory/1724-96-0x000000013F180000-0x000000013F4D4000-memory.dmp upx behavioral1/memory/1728-95-0x000000013F950000-0x000000013FCA4000-memory.dmp upx behavioral1/files/0x0005000000018fb8-106.dat upx behavioral1/memory/3016-81-0x000000013F8D0000-0x000000013FC24000-memory.dmp upx behavioral1/files/0x0005000000018fb4-79.dat upx behavioral1/memory/2904-92-0x000000013F9C0000-0x000000013FD14000-memory.dmp upx behavioral1/memory/2524-72-0x000000013F1D0000-0x000000013F524000-memory.dmp upx behavioral1/files/0x0005000000018fb5-88.dat upx behavioral1/memory/2696-78-0x000000013FDA0000-0x00000001400F4000-memory.dmp upx behavioral1/files/0x0005000000018fb0-75.dat upx behavioral1/memory/2880-59-0x000000013FCF0000-0x0000000140044000-memory.dmp upx behavioral1/memory/2356-58-0x000000013F560000-0x000000013F8B4000-memory.dmp upx behavioral1/files/0x0006000000018d48-62.dat upx behavioral1/files/0x0009000000016d66-56.dat upx behavioral1/memory/2608-52-0x000000013F420000-0x000000013F774000-memory.dmp upx behavioral1/memory/2904-43-0x000000013F9C0000-0x000000013FD14000-memory.dmp upx behavioral1/files/0x0003000000017801-42.dat upx behavioral1/memory/2696-39-0x000000013FDA0000-0x00000001400F4000-memory.dmp upx behavioral1/memory/2704-36-0x000000013F960000-0x000000013FCB4000-memory.dmp upx behavioral1/files/0x00070000000185e6-48.dat upx behavioral1/files/0x000700000001722b-11.dat upx behavioral1/memory/3036-143-0x000000013F800000-0x000000013FB54000-memory.dmp upx behavioral1/memory/1964-144-0x000000013F9C0000-0x000000013FD14000-memory.dmp upx behavioral1/memory/3064-145-0x000000013F4D0000-0x000000013F824000-memory.dmp upx behavioral1/memory/2704-146-0x000000013F960000-0x000000013FCB4000-memory.dmp upx behavioral1/memory/2696-147-0x000000013FDA0000-0x00000001400F4000-memory.dmp upx behavioral1/memory/2904-148-0x000000013F9C0000-0x000000013FD14000-memory.dmp upx behavioral1/memory/2608-149-0x000000013F420000-0x000000013F774000-memory.dmp upx behavioral1/memory/2880-150-0x000000013FCF0000-0x0000000140044000-memory.dmp upx behavioral1/memory/2604-151-0x000000013FD10000-0x0000000140064000-memory.dmp upx behavioral1/memory/2524-152-0x000000013F1D0000-0x000000013F524000-memory.dmp upx behavioral1/memory/3016-153-0x000000013F8D0000-0x000000013FC24000-memory.dmp upx behavioral1/memory/1728-154-0x000000013F950000-0x000000013FCA4000-memory.dmp upx behavioral1/memory/1724-155-0x000000013F180000-0x000000013F4D4000-memory.dmp upx behavioral1/memory/1992-156-0x000000013F750000-0x000000013FAA4000-memory.dmp upx -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\NwHzfow.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\nXXLFXa.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\bgmCAPZ.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\lgCeoKf.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\QZAWNXh.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\hGiQWFO.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\UDerJCj.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\TAKNIzQ.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\mWLTgSf.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\uvPQvyx.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\CfjMRvA.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\fsnorYV.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\TSOeCPn.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\rNKmruE.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\RJXEvcQ.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\pZsxSwi.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\NoEZEEo.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\XDcmixu.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\sMjbBqD.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\VYhCUAS.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\wLOiYFZ.exe 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe Token: SeLockMemoryPrivilege 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2356 wrote to memory of 3036 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 31 PID 2356 wrote to memory of 3036 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 31 PID 2356 wrote to memory of 3036 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 31 PID 2356 wrote to memory of 1964 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 32 PID 2356 wrote to memory of 1964 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 32 PID 2356 wrote to memory of 1964 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 32 PID 2356 wrote to memory of 3064 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 33 PID 2356 wrote to memory of 3064 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 33 PID 2356 wrote to memory of 3064 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 33 PID 2356 wrote to memory of 2704 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 34 PID 2356 wrote to memory of 2704 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 34 PID 2356 wrote to memory of 2704 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 34 PID 2356 wrote to memory of 2696 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 35 PID 2356 wrote to memory of 2696 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 35 PID 2356 wrote to memory of 2696 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 35 PID 2356 wrote to memory of 2904 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 36 PID 2356 wrote to memory of 2904 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 36 PID 2356 wrote to memory of 2904 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 36 PID 2356 wrote to memory of 2608 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 37 PID 2356 wrote to memory of 2608 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 37 PID 2356 wrote to memory of 2608 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 37 PID 2356 wrote to memory of 2880 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 38 PID 2356 wrote to memory of 2880 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 38 PID 2356 wrote to memory of 2880 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 38 PID 2356 wrote to memory of 2604 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 39 PID 2356 wrote to memory of 2604 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 39 PID 2356 wrote to memory of 2604 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 39 PID 2356 wrote to memory of 2524 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 40 PID 2356 wrote to memory of 2524 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 40 PID 2356 wrote to memory of 2524 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 40 PID 2356 wrote to memory of 3016 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 41 PID 2356 wrote to memory of 3016 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 41 PID 2356 wrote to memory of 3016 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 41 PID 2356 wrote to memory of 1724 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 42 PID 2356 wrote to memory of 1724 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 42 PID 2356 wrote to memory of 1724 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 42 PID 2356 wrote to memory of 1728 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 43 PID 2356 wrote to memory of 1728 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 43 PID 2356 wrote to memory of 1728 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 43 PID 2356 wrote to memory of 1992 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 44 PID 2356 wrote to memory of 1992 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 44 PID 2356 wrote to memory of 1992 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 44 PID 2356 wrote to memory of 2388 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 45 PID 2356 wrote to memory of 2388 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 45 PID 2356 wrote to memory of 2388 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 45 PID 2356 wrote to memory of 2800 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 46 PID 2356 wrote to memory of 2800 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 46 PID 2356 wrote to memory of 2800 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 46 PID 2356 wrote to memory of 1084 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 47 PID 2356 wrote to memory of 1084 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 47 PID 2356 wrote to memory of 1084 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 47 PID 2356 wrote to memory of 1424 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 48 PID 2356 wrote to memory of 1424 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 48 PID 2356 wrote to memory of 1424 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 48 PID 2356 wrote to memory of 2168 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 49 PID 2356 wrote to memory of 2168 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 49 PID 2356 wrote to memory of 2168 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 49 PID 2356 wrote to memory of 2216 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 50 PID 2356 wrote to memory of 2216 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 50 PID 2356 wrote to memory of 2216 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 50 PID 2356 wrote to memory of 960 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 51 PID 2356 wrote to memory of 960 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 51 PID 2356 wrote to memory of 960 2356 202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe"C:\Users\Admin\AppData\Local\Temp\202408243d969de7f5c82111ed2bc8f3401c124acobaltstrikecobaltstrikepoetrat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\System\bgmCAPZ.exeC:\Windows\System\bgmCAPZ.exe2⤵
- Executes dropped EXE
PID:3036
-
-
C:\Windows\System\TAKNIzQ.exeC:\Windows\System\TAKNIzQ.exe2⤵
- Executes dropped EXE
PID:1964
-
-
C:\Windows\System\RJXEvcQ.exeC:\Windows\System\RJXEvcQ.exe2⤵
- Executes dropped EXE
PID:3064
-
-
C:\Windows\System\pZsxSwi.exeC:\Windows\System\pZsxSwi.exe2⤵
- Executes dropped EXE
PID:2704
-
-
C:\Windows\System\VYhCUAS.exeC:\Windows\System\VYhCUAS.exe2⤵
- Executes dropped EXE
PID:2696
-
-
C:\Windows\System\NoEZEEo.exeC:\Windows\System\NoEZEEo.exe2⤵
- Executes dropped EXE
PID:2904
-
-
C:\Windows\System\lgCeoKf.exeC:\Windows\System\lgCeoKf.exe2⤵
- Executes dropped EXE
PID:2608
-
-
C:\Windows\System\XDcmixu.exeC:\Windows\System\XDcmixu.exe2⤵
- Executes dropped EXE
PID:2880
-
-
C:\Windows\System\mWLTgSf.exeC:\Windows\System\mWLTgSf.exe2⤵
- Executes dropped EXE
PID:2604
-
-
C:\Windows\System\uvPQvyx.exeC:\Windows\System\uvPQvyx.exe2⤵
- Executes dropped EXE
PID:2524
-
-
C:\Windows\System\QZAWNXh.exeC:\Windows\System\QZAWNXh.exe2⤵
- Executes dropped EXE
PID:3016
-
-
C:\Windows\System\CfjMRvA.exeC:\Windows\System\CfjMRvA.exe2⤵
- Executes dropped EXE
PID:1724
-
-
C:\Windows\System\hGiQWFO.exeC:\Windows\System\hGiQWFO.exe2⤵
- Executes dropped EXE
PID:1728
-
-
C:\Windows\System\fsnorYV.exeC:\Windows\System\fsnorYV.exe2⤵
- Executes dropped EXE
PID:1992
-
-
C:\Windows\System\sMjbBqD.exeC:\Windows\System\sMjbBqD.exe2⤵
- Executes dropped EXE
PID:2388
-
-
C:\Windows\System\UDerJCj.exeC:\Windows\System\UDerJCj.exe2⤵
- Executes dropped EXE
PID:2800
-
-
C:\Windows\System\wLOiYFZ.exeC:\Windows\System\wLOiYFZ.exe2⤵
- Executes dropped EXE
PID:1084
-
-
C:\Windows\System\TSOeCPn.exeC:\Windows\System\TSOeCPn.exe2⤵
- Executes dropped EXE
PID:1424
-
-
C:\Windows\System\NwHzfow.exeC:\Windows\System\NwHzfow.exe2⤵
- Executes dropped EXE
PID:2168
-
-
C:\Windows\System\nXXLFXa.exeC:\Windows\System\nXXLFXa.exe2⤵
- Executes dropped EXE
PID:2216
-
-
C:\Windows\System\rNKmruE.exeC:\Windows\System\rNKmruE.exe2⤵
- Executes dropped EXE
PID:960
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5662a89755770e34e75ee6e8318e6cac4
SHA190d7bcebaf5319d22f31d881fe603b09838704a6
SHA256e3d78a59b0eed4bafa842e9b6b330518302b1a2c24812d0d7c2b116592b680b6
SHA5127c19a53674aa230db47635b0d399174b5319022224f4fa674b934d5aa636d1d1e308057c1eabc6e3e0b19a035e7fb589c54fa1b2ae997b38b41c63d645d14852
-
Filesize
5.9MB
MD589a08440a2c8a25cd18e2aee7d4c5866
SHA191c889007abb775ae68d6a41343ba1b24de3c6bf
SHA25614b3ea581ff5e854ee00dce3b9459a7bc829706c85771df64a0c1fb61d1ac5c0
SHA5123f5dcf86b768c968bd96e3f87fb534f687f7eb932967b0818d3ace3f62167e898831720ecab0b83c3649f4b0ebe21556c50b3afb6a77c9028c2843fe1c326886
-
Filesize
5.9MB
MD58c1afd335b314e8e9560c192b5df1a7a
SHA18dd27e0b7dc2275a2b45833c7b925ff6046c2d67
SHA25627e67472c8e0c8ecd58c851c5e4b000a70d6bbff92c89f752b605a06204d6c84
SHA512d04cf516405af97b3eefa9e4d2472447e3ed2e3b1792dc4693ce2d58f0259e01869fe627aba5922b94fdcab841a23feeb661d2048d1ec8ee7296944ba65c93d8
-
Filesize
5.9MB
MD56c3bde8808d05e4e33bd86777b715887
SHA1486bb21409bf7a0173d59c4ec7f6721b28574b8c
SHA256abdf474bc6d3090ba5183203edb9246257cc4307892663f5d497060040eca0fc
SHA512beb3a0f05a7726cb99ca0d6be21cf0f8be527e58cdd1a62e27066c498b3eff11a9c3cc133063293cc3bc0436b25b9bd62554b4677d5d29eb8381feccb23f41aa
-
Filesize
5.9MB
MD53249650850a5f528018b9f7da28e8f85
SHA1d4e966c695f2fe848d1efa0abae7e4c8a64fc029
SHA2566a8ca47cf40353ced4b0d251f101f20f562e68e2a7b58beb00a3f29d7ee54cd0
SHA512f328ff4c194506b102da74b2ae808c956d70fcf36b513ad217ba00cb0f3a0d26d7622b6e9959334ee8899bc4268a50c5b88d0a0217571fc19d709007ef9c90ef
-
Filesize
5.9MB
MD5df41336fb0c31d611351af28466cad89
SHA1f7475531db339fbcfeda51c0154d57b699874caa
SHA2565864278a9eef864d61f7d596be433edf9856cf42ec6945b6ff52182c4ae4d6bd
SHA512587c4864238726c9393cfd670fabad1275000d18b4b9a70a551b636be4c9a9263b7152cb52c6e422fdc340b89b7d6050d87019e678ecaafaef7687a491dbdec9
-
Filesize
5.9MB
MD5af3f704114edec52ea7f422cfc7336fb
SHA12faf76d60434da929b63635e9680a110a8e83900
SHA2566d6fce734b81e4e096e249e65f330a9bf8929ab492ce4afa38058e1147724efb
SHA51241b6abd74b078025ba6d6eb8868f04752cd3c8430885c80248c1cf023edc41456dd666cfd74dfdb176b933404f85f79a9b50a3defb45a264a85bd38732552d5c
-
Filesize
5.9MB
MD55a838a38def974ed1ed0d855702e3ea4
SHA190aa837552fa51ef1cb9b9fa5732be1cd4805643
SHA256e309a4e3e9900f19888bbaddbf4da80a1d5b07abd1c3111bad2e79127cd0fa41
SHA512801a19c064a7c66eb4f79bd47d82abd7372b4e7d09a69e72149eacafe14d2aa44f12b1d6570f7880db7dac1c993905fc7cc632a80ed43fad52ebba08f98225fa
-
Filesize
5.9MB
MD5b464ad2ba9f5f3296996517bf1ed87cc
SHA1939ac127e5e5e1828f126c2fe86013735ba60ae2
SHA2568cb3a441f1f13b4ae77e826f7c1fa7d7bc38647075cbbe371df8a40a981162be
SHA512723f88c0bd0740498f340dcac7a8154c75370fb820cf464bd3eb32d55e67c0f5ee815f611389d197b1f5acecb728e1a54443a2b457a43fd52a7640606ce27129
-
Filesize
5.9MB
MD59f53213482b2764794baeb01e7adab04
SHA1c0b1ac2dd9762236445dfa5c150dff3ad966901b
SHA2562c6ea9166971d23145faab0ffd983ee468fb2cad58e2966450440039a6f6ee64
SHA5122d94a31a6809b08422eef6fb9324744965cfea79240ba9dd2d5d64523b2e405995fa8f882cd5eeb96667797ec5b344fd3f08e315062936aab1cb314a2e88536b
-
Filesize
5.9MB
MD57de3ef09400ec3a7c5b29e2da83e28f7
SHA11ba692bfacb1cc1b56154de7aee55ab1b9169e20
SHA25629d48c0f7e94a2a1a2008b6af77a1f6c70d4f44ad72e63687c951893d288677a
SHA5129b85c3a069e9f6c59f217050679e8917f80482627972405785a81e3688621b88964ed595d3ab019846ca46aaa941d1c30fdb0559cb88b8454a9752bdeea8df86
-
Filesize
5.9MB
MD5ff5ab4131e02d5c34d7b03ef77fd6ac5
SHA15df5f3d39a67ffaf34522f28a1bf6bee2c30484e
SHA256ff32573dfc962ee469874e0b172bd607a63ff26c0d9b5f707b1ba00ef0b09f90
SHA5127142bfa8a81552435d868bfede9e2d2ed70dfb3375584acd106c2e386283467aebf1adf30b86712098c4ac7b87c21cbdf724c2182a72d780ed23803c1e3745d9
-
Filesize
5.9MB
MD55a99a7c513b032b612274b7a1e5e3d4b
SHA1ae6802b609eff2102819998fe93070627a9b696a
SHA2568b88e2b85fe00566e540e75fdec443c648d71249fffa3d1007b849e580993f28
SHA5124397cd83e6ae1440bd7a04b4fef135be4d3a5c4c3900b47a665186ab81be71f5e3a21609b8b137d4a50059e251afd246bf146e0b7ae167c5343882da86290a11
-
Filesize
5.9MB
MD5d6b26b7cbb7a5a6f9a11a9a34bfc48b9
SHA15c2936cb4f5348bcd75bf568a9d732d6086d6580
SHA25645daf25523b3aa047d6618a1ebbbe1cd40a70645d1d6e497bf19930cca6a01ef
SHA5128a149c2b2c14686009ff9d4789926175d847c1deb2d884a482ad135195a6bcafc377a99336f6769a5fce02766ae89f56c228c49091f3f9d62424e437d19a6519
-
Filesize
5.9MB
MD5ff23c887d422170967e7c45d61150d07
SHA1bd07c5c444cf88b6722183f85a0a4afc78503f8f
SHA256c0bb6f906d0ef707820fa0949d946a3e8f33c5745d7567991dabedbd613a53f7
SHA512af8f8caa4b29a4e46aa91c52e976e089c1509c1783da2ef9141fc681decb712066be2d94f30c84b84359961357cfd86e15c593fe6071aa475f4e2db817752f41
-
Filesize
5.9MB
MD58b8a249887af1f1f038196870c42bc45
SHA1025725e332908243a7356083d3218870a6ef3b9b
SHA256d4fef1cdc2f563d073d972b5381ff45580ac11940d70737219d7d008508fa7de
SHA512466a13fc6f9ec9f00c75dc6417582b457b2ebaab39d1fe1a89ee7a6b2cb23cebeaf34a0039a8e37a50c1046b1daac8d4457e4efda5942cf7963a3d9386f32c9a
-
Filesize
5.9MB
MD52e2788f6dc20aca429b9d6cdaa9a2103
SHA15a8d4eaf21e99833eaee68000978deddf3646fcf
SHA256c083675d68a8515cc00f7948876a523eed5b1f92f0fbea5a30441246c211c95d
SHA512d762e83b6885d1837ca9765b86cf21e10e52c454c83d618504262110792bd380617df9a87a1cb6b15592dfa5e7b9a31dfa86216a67e663fda83949660ec95bf0
-
Filesize
5.9MB
MD53326373af10ff034b538ce9c3ba85c47
SHA1908856f9087de01d46710ae6d582909a33a3bb64
SHA2563966e605c8a1f2f93163352e39073b4537411ec007c45735497e4b89b830029b
SHA5122b9a0a0f2ec9117c012e8af3005bd55740a86ad4bfa9d7af3c14058b7a67418d98aac1f56c1e2cccd49feae793e2b9a89b29b061257c1be7bda26e2e43718fd8
-
Filesize
5.9MB
MD52caeefade6ab49311a0c2e455e7de7bd
SHA1a034cc8df09e599b97adbfd185cf99876a63507a
SHA256b54ac786be8307ca8b0d35e9ecf4d88eafa4e5a7f0597bf2eeae4e375944dc91
SHA512bf16bea1a05cfcaee0811611201a0736466fe5f8b266f0ef29372a4f73e401a3da3ab2109c02ec945d5bfcea1e944fb4abae844af8d847a1cb1b9a3b0ce4a350
-
Filesize
5.9MB
MD53808090799c8a7a2fbd378571c4f7b0b
SHA191060ff8a6b79467087f03ae1b686b4a3255434f
SHA2562298bc4c7e0fac58ebfc8b63d8f44871298e0903f02751eed2fc362130731996
SHA51238fa4e8695a282261b4c3d055d7a6b64a36470bcf9ece5e675ce669140cf927fe4e6df233315e11f93878407828e0236f1629db33556c1878da2a710ed7b1edc
-
Filesize
5.9MB
MD58d05c6a127b70c9fb72de7c321db5f25
SHA14e1a705474303596264b0280061203628af25860
SHA256fdabdaca826cf6d889afabb3a080cca6de4aede16eef48d3549db8903b245319
SHA5123711174b1e4816c4fb6e2c216a01b3b19e497ced8a4bffa9b585f181f7ad0c4e373c8b3cf75c087c40be0d65612e12f65aea5b6731e91f86475079ca07ad4111